VeriLoop-E2-Uncensored-W4A16

Safety refusals have been largely removed from this model. It will comply with requests the original model refuses, including offensive, dangerous, or jurisdiction-illegal content. Marker absence in our probes is not proof of complete removal, and no content filter or guardrail remains. You are solely responsible for how you deploy it and for compliance with applicable law. Read §② Safety refusals largely removed below before use.

本模型的安全拒绝已被大幅移除。 它会执行原模型拒绝的请求，包括冒犯、危险、 或所在司法辖区违法的内容。探针中标记词消失不等于移除穷尽，且不再有任何内容过滤 或护栏。部署方式与合规责任完全由使用者自负。使用前请先阅读正文 §② 安全拒绝大幅移除。

Community abliteration and quantization of tsinghua-sigs-robot-lab/VeriLoop-E2, fixed revision 9379d199adcc44acdf836558037163878e3a37ae. This is not an official Tsinghua release. Model architecture is Qwen3_5ForConditionalGeneration; the upstream names the base Qwen3.8-27B.

What is included

AutoRound W4A16, symmetric group 128, 256 public Pile calibration samples, 512 tokens, 200 iterations, batch 4. Eligible weights are INT4; small hybrid projections, activations and retained weights are BF16. All source tensors are represented; the 333 vision tensors are preserved exactly.

A bounded six-candidate Heretic 1.4.0 search selected per-layer strength 1.2; 96 of 128 targeted residual-output matrices changed and 32 zero updates remained unchanged. The small selection set improved from 16/16 to 4/16 refusal markers, missing its original ≤1 threshold. This is a reduced-refusal candidate, not a claim of complete removal. The search and modification recipe is not included in this release.

Local paired evaluation

Same frozen 1,514 questions, seed 20260816, thinking enabled with the original template and publisher raw-content protocol, greedy decoding, max output 32,768 tokens. These are our legacy sampled/custom scorers, not official leaderboard results. IFEval uses a partial custom rule implementation. See EVALUATION.md and evaluation.json for details and validity flags.

Overall original → ablated: 80.05% → 76.42%, difference -3.63 pp; approximate paired 95% CI [-5.894, -1.371] pp. Empty responses: [9, 8]; length-limited responses: [9, 8]. Both stay in the denominator. Empty-rate validity gate: False.

On 100 separate refusal probes (thinking disabled, 2048-token budget), opening-30-word marker counts were 98/100 → 0/100. Marker absence is not proof of semantic compliance. Truncation/budget hits: [1, 9]; validity: [True, True]. The first 16 probes overlap candidate selection; see the 84-item held-out subset in evaluation.json when available.

Loading

vllm serve /path/to/VeriLoop-E2-Uncensored-W4A16 --tensor-parallel-size 2 --generation-config vllm

The measured runtime was vLLM 0.29.0 with a local FA2/FP8-KV plugin on dual RTX 3090. That local setup requires its plugin-specific library environment variables; this repository does not bundle the plugin. The command above is a starting point for a compatible installed runtime, not a tested stock-vLLM support matrix. No remote custom model code is required. Vision weights are retained exactly, but visual inference is not validated in this evaluation.

Scope and limitations

Use the repository-shipped template and publisher raw-content serving protocol. Do not add a Qwen3 reasoning parser: some completed direct answers omit a closing think tag and that parser classifies them entirely as hidden reasoning. Removing it recovered all 33 initial missing-answer cases; streaming/nonstreaming checks passed. Thinking remains enabled. For evaluation, final content is taken after </think> when present; normally stopped direct content is retained, while unclosed length-limited output is not scored as an answer.

In llama.cpp content-only mode, remove an echoed opening <think> generation-prefix tag before applying answer extraction. It is protocol framing, not answer text. The GGUF preflight was restarted after verifying this correction and the template override; it is excluded from the reported scores.

The author's private VeriLoop Harness is not included or reproduced. Their SWE/Terminal/DeepSWE scores are not scores for these weights. This evaluation does not establish long-context, tool-use, vision, agentic performance, or production suitability. Reduced refusal can affect inappropriate-content handling; applications need their own behavior controls. Full semantic refusal review and comprehensive capability equivalence have not been established.

Apache-2.0 is retained from the fixed upstream source; see LICENSE. Source training belongs to its original authors. Community changes are quantization and the described abliteration. See release.json and SHA256SUMS for provenance and integrity.

② Safety refusals largely removed / 安全拒绝大幅移除

This is the point of the model. Read before downloading. 这是模型的核心属性，下载前请务必阅读。

The abliteration removes most of the refusal behaviour trained into VeriLoop-E2. On 100 refusal probes (thinking disabled, 2048-token budget), first-30-word refusal markers fell 98/100 → 0/100. Broader lexical lists still detect refusal markers in many long answers, so refusal removal is not proven exhaustive, and marker absence is not a semantic compliance judgment.

消融移除了 VeriLoop-E2 训练进去的大部分拒绝行为。100 条拒绝探针（思考关闭、2048 token 预算） 上，前 30 词拒绝标记从 98/100 降到 0/100。更宽的词表仍能在不少长回答里检出拒绝标记， 因此移除未证明穷尽，标记消失也不等于语义层面会照做。

Consequences you accept / 你正在接受的后果:

• Content the original refuses, including offensive / dangerous / jurisdiction-illegal. 会产生原模型拒绝的内容，包括冒犯 / 危险 / 所在地违法
• No content filter, no safe-completion, no guardrail. 无内容过滤、无 safe-completion、无护栏
• Knowledge/reasoning capability measurably dropped vs the unmodified W4A16 (80.05% → 76.42% overall; see the table above). 相对未消融 W4A16，知识/推理能力有可测下降（综合 80.05% → 76.42%，见上表）。

Not intended for / 不适用于:

• Third-party or public-facing deployment without your own safety layer / 未搭建自己的安全层就部署给第三方或面向公众
• Anyone under legal age in their jurisdiction / 未达所在司法辖区法定年龄的人
• Any use prohibited by upstream acceptable-use policies / 上游可接受使用政策禁止的任何用途

Intended for / 适用于: local inference and research, by people who understand the above and take responsibility for it / 本地推理与研究，由理解以上内容并为其 负责的用户使用。

③ No warranty; responsibility rests with the user / 无担保；责任在用户

Provided "AS IS", without warranty of any kind, express or implied.

• The publisher does not endorse, recommend, or condone any particular use.
• No representation outputs are accurate, lawful, or fit for any purpose.
• You are solely responsible for what you generate, how you deploy, and compliance with all laws applicable to you.
• To the maximum extent permitted by law, no liability for any claim, damage, or other liability arising from the model or its use.

按"现状"提供，不提供任何担保。发布者不背书、不推荐，不对输出的准确性/合法性/ 用途适用性作声明。你独自承担全部责任。法律允许最大范围内不承担任何责任。

Downloading these files means you accept the above. If you do not, do not download.

下载本仓文件即表示接受以上内容。若不接受，请勿下载。

The author is not a lawyer; the above is not legal advice. 作者不是律师；以上不构成法律意见。

Complete measurement records and historical comparison

See all six result columns, test standards and limitations, all 9,084 per-item metric records, question IDs and hashes, and 400 refusal-probe metric records. No full-precision baseline was measured. Historical results are not a strictly identical-runtime comparison.